Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
57 results · page 1 of 2
Oct 29, 2026Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.CVE-2026-118085 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.
- Affected
- up to 1.23.3
- What to do
- Affects up to 1.23.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2026Infility Global: Does not perform any authorisation or nonce check on an AJAX action available to unauthenticated usersCVE-2026-109931 · WordPress plugins & themes · reported by WPScanLow 3.7
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
- Product
- Infility Global
- Fixed in
- 2.16.25
- What to do
- Update Infility Global to 2.16.25 or newer.
Oct 17, 2026ACF Frontend Admin by DynamiApps: Does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options storeCVE-2026-81343 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.
- Product
- ACF Frontend Admin by DynamiApps
- Affected
- up to 3.29.13
- What to do
- Affects up to 3.29.13. Update ACF Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Passster: Has a flaw in its global protection checksCVE-2025-15490 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs
- Product
- Passster
- Fixed in
- 4.2.26
- What to do
- Update Passster to 4.2.26 or newer.
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-73184 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
- Affected
- up to 11.1.2
- What to do
- Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026Infility Global: Stored Cross-Site ScriptingCVE-2026-10734 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7_record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The /cf7_records viewer is accessible to any authenticated user including those with Subscriber-level access, meaning the injected payload executes for any logged-in user who visits the records page.
- Product
- Infility Global
- Affected
- up to 2.15.21
- What to do
- Affects up to 2.15.21. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 9, 2026Nexter Blocks: Does not restrict who can save global CSS through one of its REST endpointsCVE-2026-17011 · WordPress plugins & themes · reported by WPScanLow 3.8
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
- Product
- Nexter Blocks
- Fixed in
- 5.0.2
- What to do
- Update Nexter Blocks to 5.0.2 or newer.
Aug 6, 2026Passster: Does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST APICVE-2025-15674 · WordPress plugins & themes · reported by WPScanLow 2.7
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of protected pages and posts without knowing the password.
- Product
- Passster
- Fixed in
- 4.3.7
- What to do
- Update Passster to 4.3.7 or newer.
Aug 4, 2026Brizy: Does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting itCVE-2026-16068 · WordPress plugins & themes · reported by WPScanLow 3.5
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
- Product
- Brizy
- Fixed in
- 2.8.19
- What to do
- Update Brizy to 2.8.19 or newer.
Jun 23, 2026Infility Global: Does not properly sanitize and escape some parameters before using them in SQL statementsCVE-2026-8163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
- Product
- Infility Global
- Fixed in
- 2.15.19
- What to do
- Update Infility Global to 2.15.19 or newer.
Jun 23, 2026Infility Global Infility Global: For WordPress does not sanitize or validate the orderby and order parameters in the import_list()CVE-2026-7842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
- Product
- Infility Global Infility Global
- Fixed in
- 2.15.20
- What to do
- Update Infility Global Infility Global to 2.15.20 or newer.
Jun 9, 2026Global Body Mass Index Calculator: Stored Cross-Site ScriptingCVE-2026-8883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the GBMI_Calc_Widget::widget() function. Shortcode attributes are extracted directly into local variables via @extract($args) and then echoed unescaped into an HTML style attribute (height/width) and HTML body context (title), allowing attribute-breakout payloads. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Global Body Mass Index Calculator
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Global Body Mass Index Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2026Infility Global: SQL InjectionCVE-2026-8685 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Infility Global
- Affected
- up to 2.15.16
- What to do
- Affects up to 2.15.16. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026GlobalPayments WooCommerce: Server-Side Request Forgery (SSRF)CVE-2026-39645 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.18.0.
- Product
- GlobalPayments WooCommerce
- Affected
- up to 1.18.0
- What to do
- Affects up to 1.18.0. Update GlobalPayments WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Global Logistics: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28018 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through <= 3.20.
- Product
- Global Logistics
- Affected
- up to 3.20
- What to do
- Affects up to 3.20. Update Global Logistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2026Infility Global: Unauthenticated SQL InjectionCVE-2025-15268 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append - with certain server configurations - additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Infility Global
- Affected
- up to 2.14.46
- What to do
- Affects up to 2.14.46. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68864 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Stored XSS.This issue affects Infility Global: from n/a through <= 2.15.11.
- Product
- Infility Global
- Affected
- up to 2.15.11
- What to do
- Affects up to 2.15.11. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026Infility Global: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68865 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.
- Product
- Infility Global
- Affected
- up to 2.15.06
- What to do
- Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2025Infility Global: Arbitrary file uploadsCVE-2025-12968 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` class only validating the MIME type which can be easily spoofed, and the `import_data` function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Infility Global
- Affected
- up to 2.14.42
- What to do
- Affects up to 2.14.42. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 3, 2025WP Global Screen Options: Cross-Site Request ForgeryCVE-2025-12069 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for all users via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
- Product
- WP Global Screen Options
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update WP Global Screen Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 13, 2025The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password.CVE-2025-10720 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Private Content Plus through 3.6.2 provides a global content protection feature that requires a password. However, the access control check is based only on the presence of an unprotected client-side cookie. As a result, an unauthenticated attacker can completely bypass the password protection by manually setting the cookie value in their browser.
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WEDOS Global: Missing AuthorizationCVE-2025-60130 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.
- Product
- WEDOS Global
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update WEDOS Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Global DNS: Improper Control of Generation of Code ('Code Injection')CVE-2025-53577 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Code Inclusion.This issue affects Global DNS: from n/a through <= 3.1.0.
- Product
- Global DNS
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Global DNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Infility Global: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through <= 2.15.06.
- Product
- Infility Global
- Affected
- up to 2.15.06
- What to do
- Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Global Gallery: Missing AuthorizationCVE-2025-52721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3.
- Product
- Global Gallery
- Affected
- up to 9.2.3
- What to do
- Affects up to 9.2.3. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47652 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.13.4.
- Product
- Infility Global
- Affected
- up to 2.13.4
- What to do
- Affects up to 2.13.4. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52774 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.15.06.
- Product
- Infility Global
- Affected
- up to 2.15.06
- What to do
- Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Infility Global: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47651 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.
- Product
- Infility Global
- Affected
- up to 2.15.06
- What to do
- Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Global Translator: Cross-Site Request Forgery (CSRF)CVE-2025-30632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pozzad Global Translator global-translator allows Cross Site Request Forgery.This issue affects Global Translator: from n/a through <= 2.0.2.
- Product
- Global Translator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Global Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Global Translator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30630 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pozzad Global Translator global-translator allows Stored XSS.This issue affects Global Translator: from n/a through <= 2.0.2.
- Product
- Global Translator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Global Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Global Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22263 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue affects Global Gallery: from n/a through 8.8.0.
- Product
- Global Gallery
- Affected
- up to 8.8.0
- What to do
- Affects up to 8.8.0. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025GlobalPayments WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22767 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Reflected XSS.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.13.2.
- Product
- GlobalPayments WooCommerce
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update GlobalPayments WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2025LTL Freight Quotes – GlobalTranz Edition: Unauthorized modification of dataCVE-2025-1483 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint in all versions up to, and including, 2.3.12. This makes it possible for unauthenticated attackers to update the drop shipping settings.
- Product
- LTL Freight Quotes – GlobalTranz Edition
- Affected
- up to 2.3.12
- What to do
- Affects up to 2.3.12. Update LTL Freight Quotes – GlobalTranz Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 20, 2025LTL Freight Quotes – GlobalTranz Edition: SQL InjectionCVE-2024-13476 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions up to, and including, 2.3.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- LTL Freight Quotes – GlobalTranz Edition
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update LTL Freight Quotes – GlobalTranz Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2025Global Meta Keyword & Description: Cross-Site Request Forgery (CSRF)CVE-2025-26550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This issue affects Global Meta Keyword & Description: from n/a through <= 2.3.
- Product
- Global Meta Keyword & Description
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Global Meta Keyword & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025The Global Gallery - WordPress Responsive Gallery: Arbitrary shortcode executionCVE-2024-13814 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Global Gallery - WordPress Responsive Gallery
- Affected
- up to 9.1.5
- What to do
- Affects up to 9.1.5. Update The Global Gallery - WordPress Responsive Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.netlcweb.it
Feb 7, 2025GlobalQuran: Cross-Site Request Forgery (CSRF)CVE-2025-25143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a through <= 1.0.
- Product
- GlobalQuran
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update GlobalQuran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2025Infility Global: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12723 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Infility Global
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Infility Global: Reflected Cross-Site ScriptingCVE-2024-12290 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2024-12723 is a duplicate of this issue.
- Product
- Infility Global
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 7, 2025Infility Global: Unauthorized modification of dataCVE-2024-11496 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax function in all versions up to, and including, 2.9.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options and potentially break the site.
- Product
- Infility Global
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 14, 2024Global Gateway e4 | Payeezy Gateway |: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52371 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4.This issue affects Global Gateway e4 | Payeezy Gateway |: from n/a through <= 2.0.
- Product
- Global Gateway e4 | Payeezy Gateway |
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Global Gateway e4 | Payeezy Gateway | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2024Global Notification Bar: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35647 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Notification Bar allows Stored XSS.This issue affects Global Notification Bar: from n/a through 1.0.1.
- Product
- Global Notification Bar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Global Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 9, 2024Global Elementor Buttons: Stored Cross-Site ScriptingCVE-2024-2327 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Global Elementor Buttons
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Global Elementor Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 20, 2023Zendrop – Global Dropshipping: Unrestricted Upload of File with Dangerous TypeCVE-2023-25970 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
- Product
- Zendrop – Global Dropshipping
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Zendrop – Global Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versCVE-2023-47773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 3, 2023Zendrop – Global Dropshipping: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25960 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
- Product
- Zendrop – Global Dropshipping
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Zendrop – Global Dropshipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.CVE-2023-45103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2022Perfect Survey: Does not have proper authorisation nor CSRF checks in the save_global_setting AJAX actionCVE-2021-24763 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
- Product
- Perfect Survey
- Fixed in
- 1.5.2
- What to do
- Update Perfect Survey to 1.5.2 or newer.
Sep 1, 2021The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file.CVE-2021-39320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
- Product
- underConstruction
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
Nov 2, 2020WordPress before 5.5.2 allows XSS associated with global variables.CVE-2020-28034 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.5.2 allows XSS associated with global variables.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.